Although neural networks achieve remarkable success in many complex classification tasks, such as speech and image recognition, researchers discover that non-robust neural networks are vulnerable to the perturbation from environment and adversarial attacks [1]}, [2]}, [3]}, [3]}. In some safety-critical and security-sensitive domain, such as self-driving [5]} and face recognition [6]}, some subtle adversarial perturbation is extremely imperceptible and harmful, and may cause disastrous consequences. Therefore, there is a great need to certify model robustness guarantees against adversarial attacks, which can provide certified defense against any possible attack [7]}, [8]}, [9]}, [10]}.
